@mestreyoda/fabrica 0.1.11 → 0.1.13

package/dist/index.js

@@ -110768,7 +110768,7 @@ var init_registry = __esm({
           senior: "\u{1F9E0}"
         },
         fallbackEmoji: "\u{1F50D}",
-        completionResults: ["pass", "fail", "refine", "blocked"],
+        completionResults: ["pass", "fail", "fail_infra", "refine", "blocked"],
         sessionKeyPattern: "tester",
         notifications: { onStart: true, onComplete: true }
       },
@@ -111329,8 +111329,8 @@ import fsSync from "node:fs";
 import path5 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function getCurrentVersion() {
-  if ("0.1.11") {
-    return "0.1.11";
+  if ("0.1.13") {
+    return "0.1.13";
   }
   try {
     const pkgPath = path5.join(THIS_DIR, "..", "..", "package.json");
@@ -112573,7 +112573,7 @@ async function resilientLabelTransition(provider, issueId, from, to, log3) {
         for (let i2 = 0; i2 < 2; i2++) {
           try {
             await provider.removeLabels(issueId, [from]);
-            log3?.(`Dual state resolved: removed ${from} from issue ${issueId}`);
+            log3?.(`dual_state_recovery: removed ${from} from issue ${issueId} (atomic PUT should have prevented this \u2014 investigate)`);
             return { success: true, dualStateResolved: true };
           } catch (retryErr) {
             log3?.(`Retry ${i2 + 1}/2 to remove ${from} failed: ${String(retryErr)}`);
@@ -114240,7 +114240,7 @@ var require_Policy = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.handleAll = exports2.noop = exports2.Policy = void 0;
     exports2.handleType = handleType;
-    exports2.handleWhen = handleWhen;
+    exports2.handleWhen = handleWhen2;
     exports2.handleResultType = handleResultType;
     exports2.handleWhenResult = handleWhenResult;
     exports2.bulkhead = bulkhead;
@@ -114367,7 +114367,7 @@ var require_Policy = __commonJS({
     function handleType(cls, predicate) {
       return new Policy({ errorFilter: typeFilter(cls, predicate), resultFilter: never2 });
     }
-    function handleWhen(predicate) {
+    function handleWhen2(predicate) {
       return new Policy({ errorFilter: predicate, resultFilter: never2 });
     }
     function handleResultType(cls, predicate) {
@@ -117174,15 +117174,23 @@ init_logger();
 
 // lib/providers/resilience.ts
 var import_cockatiel = __toESM(require_dist4(), 1);
+var GitHubRateLimitError = class extends Error {
+  constructor(retryAfterMs) {
+    super(`GitHub rate limit \u2014 retry after ${retryAfterMs}ms`);
+    this.retryAfterMs = retryAfterMs;
+    this.name = "GitHubRateLimitError";
+  }
+};
 var MAX_ENTRIES = 50;
 var policyCache = /* @__PURE__ */ new Map();
 var accessOrder = [];
 function createPolicy() {
-  const retryPolicy = (0, import_cockatiel.retry)(import_cockatiel.handleAll, {
+  const retryableErrors = (0, import_cockatiel.handleWhen)((err) => !(err instanceof GitHubRateLimitError));
+  const retryPolicy = (0, import_cockatiel.retry)(retryableErrors, {
     maxAttempts: 3,
     backoff: new import_cockatiel.ExponentialBackoff({
       initialDelay: 500,
-      maxDelay: 5e3
+      maxDelay: 1e4
     })
   });
   const breakerPolicy = (0, import_cockatiel.circuitBreaker)(import_cockatiel.handleAll, {
@@ -118097,6 +118105,35 @@ var GitHubProvider = class {
   async gh(args) {
     return this.ghAt(args, { cwd: this.repoPath });
   }
+  get providerKey() {
+    return this.repoPath;
+  }
+  /**
+   * Execute a `gh api` call with optional JSON body sent via stdin.
+   * Uses withResilience (per-provider retry + circuit breaker).
+   * Throws GitHubRateLimitError on 429 / rate limit responses.
+   */
+  async ghApi(endpoint2, method, body) {
+    const args = ["api", endpoint2, "--method", method];
+    if (body !== void 0) {
+      args.push("--input", "-");
+    }
+    return withResilience(async () => {
+      const result = await this.runCommand(["gh", ...args], {
+        timeoutMs: 3e4,
+        cwd: this.repoPath,
+        input: body !== void 0 ? JSON.stringify(body) : void 0
+      });
+      if (result.code != null && result.code !== 0) {
+        const errText = result.stderr?.trim() ?? "";
+        if (errText.includes("rate limit") || errText.includes("429")) {
+          throw new GitHubRateLimitError(6e4);
+        }
+        throw new Error(errText || `gh api ${method} ${endpoint2} failed with exit code ${result.code}`);
+      }
+      return result.stdout.trim();
+    }, this.providerKey);
+  }
   async git(args, opts) {
     const result = await this.runCommand(["git", ...args], {
       timeoutMs: opts?.timeoutMs ?? 3e4,
@@ -118152,14 +118189,28 @@ var GitHubProvider = class {
     return Buffer.from(input).toString("base64url");
   }
   async githubFetch(url2, init, auth7) {
-    const headers = new Headers(init.headers ?? {});
-    headers.set("Accept", "application/vnd.github+json");
-    headers.set("Authorization", `Bearer ${auth7.token}`);
-    headers.set("X-GitHub-Api-Version", "2022-11-28");
-    if (init.body && !headers.has("Content-Type")) {
-      headers.set("Content-Type", "application/json");
-    }
-    return fetch(url2, { ...init, headers });
+    return withResilience(async () => {
+      const headers = new Headers(init.headers ?? {});
+      headers.set("Accept", "application/vnd.github+json");
+      headers.set("Authorization", `Bearer ${auth7.token}`);
+      headers.set("X-GitHub-Api-Version", "2022-11-28");
+      if (init.body && !headers.has("Content-Type")) {
+        headers.set("Content-Type", "application/json");
+      }
+      const res = await fetch(url2, { ...init, headers });
+      const remaining = res.headers.get("x-ratelimit-remaining");
+      if (res.status === 429 || res.status === 403 && remaining === "0") {
+        const retryAfter = res.headers.get("retry-after");
+        const resetEpoch = res.headers.get("x-ratelimit-reset");
+        const waitMs = retryAfter ? parseInt(retryAfter, 10) * 1e3 : resetEpoch ? Math.max(0, parseInt(resetEpoch, 10) * 1e3 - Date.now()) + 1e3 : 6e4;
+        throw new GitHubRateLimitError(waitMs);
+      }
+      if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new Error(`GitHub API ${res.status}: ${body}`);
+      }
+      return res;
+    }, this.providerKey);
   }
   async resolveInstallationAuth() {
     const profile = this.resolveAuthProfile();
@@ -118557,7 +118608,7 @@ Bootstrapped by Fabrica.
   }
   async listIssuesByLabel(label) {
     try {
-      const raw = await this.gh(["issue", "list", "--label", label, "--state", "open", "--json", "number,title,body,labels,state,url"]);
+      const raw = await this.gh(["issue", "list", "--label", label, "--state", "open", "-L", "200", "--json", "number,title,body,labels,state,url"]);
       return JSON.parse(raw).map(toIssue);
     } catch {
       return [];
@@ -118565,7 +118616,7 @@ Bootstrapped by Fabrica.
   }
   async listIssues(opts) {
     try {
-      const args = ["issue", "list", "--state", opts?.state ?? "open", "--json", "number,title,body,labels,state,url"];
+      const args = ["issue", "list", "--state", opts?.state ?? "open", "-L", "200", "--json", "number,title,body,labels,state,url"];
       if (opts?.label) args.push("--label", opts.label);
       const raw = await this.gh(args);
       return JSON.parse(raw).map(toIssue);
@@ -118587,29 +118638,20 @@ Bootstrapped by Fabrica.
     }
   }
   async transitionLabel(issueId, from, to) {
-    await this.gh(["issue", "edit", String(issueId), "--add-label", to]);
     const issue2 = await this.getIssue(issueId);
     const stateLabels = getStateLabels(this.workflow);
-    const currentStateLabels = issue2.labels.filter((l) => stateLabels.includes(l) && l !== to);
-    const staleOperationalLabels = issue2.labels.filter(
-      (l) => LEGACY_OPERATIONAL_LABELS.includes(l)
-    );
-    if (currentStateLabels.length > 0 || staleOperationalLabels.length > 0) {
-      const args = ["issue", "edit", String(issueId)];
-      for (const l of currentStateLabels) args.push("--remove-label", l);
-      for (const l of staleOperationalLabels) args.push("--remove-label", l);
-      await this.gh(args);
-    }
+    const desired = issue2.labels.filter(
+      (l) => !stateLabels.includes(l) && !LEGACY_OPERATIONAL_LABELS.includes(l)
+    ).concat(to);
+    await this.ghApi(`repos/{owner}/{repo}/issues/${issueId}/labels`, "PUT", { labels: desired });
     try {
       const postIssue = await this.getIssue(issueId);
       const postStateLabels = postIssue.labels.filter((l) => stateLabels.includes(l));
       if (postStateLabels.length !== 1 || !postStateLabels.includes(to)) {
-        logger3.error({
-          issueId,
-          from,
-          to,
-          postStateLabels
-        }, "State transition anomaly detected after GitHub issue label transition");
+        logger3.error(
+          { issueId, from, to, postStateLabels },
+          "State transition anomaly detected after atomic label PUT"
+        );
       }
     } catch {
     }
@@ -119810,6 +119852,22 @@ PR merged \u2014 issue closed automatically (was stuck in ${event.fromState})`;
 \u{1F3C1} Done \u2014 no human action needed.`;
       return msg;
     }
+    case "infraFailure": {
+      const icon = event.infraFailCount >= 2 ? "\u{1F6A8}" : "\u26A0\uFE0F";
+      let msg = `${icon} Infrastructure failure on #${event.issueId} (attempt ${event.infraFailCount})`;
+      msg += `
+${event.summary}`;
+      msg += `
+\u{1F4CB} [Issue #${event.issueId}](${event.issueUrl})`;
+      if (event.infraFailCount >= 2) {
+        msg += `
+\u2192 Circuit breaker tripped \u2014 moved to Refining (operator intervention required)`;
+      } else {
+        msg += `
+\u2192 Returned to To Test queue \u2014 will retry after toolchain is fixed`;
+      }
+      return msg;
+    }
   }
 }
 async function sendMessage(target, message, channel, workspaceDir, runtime, accountId, runCommand, messageThreadId, auditMeta) {
@@ -120056,7 +120114,11 @@ async function persistMergedArtifact(opts) {
     },
     currentPrState: PrState.MERGED,
     followUpPrRequired: false
-  }).catch(() => {
+  }).catch((err) => {
+    console.warn(
+      JSON.stringify({ projectSlug, issueId, prNumber, error: String(err) }),
+      "persistMergedArtifact failed \u2014 issue close guard may not find merge evidence"
+    );
   });
 }
 async function guardedCloseIssue(opts) {
@@ -120543,10 +120605,10 @@ init_audit();
 init_migrate_layout();
 init_roles();
 init_workflow();
+init_labels();
 
 // lib/tools/tasks/public-output-sanitizer.ts
 var SECRET_PATTERNS = [
-  /\b[A-Za-z_][A-Za-z0-9_]*=([^\s]+)/g,
   /\b(?:ghp_|gho_|github_pat_|sk-|xoxb-|xoxp-|AIza|AKIA|glpat-)[A-Za-z0-9._-]*/g,
   /\b(?:token|secret|api[_-]?key|password|passwd|authorization|bearer)\b\s*[:=]\s*[^\s]+/gi
 ];
@@ -120871,6 +120933,7 @@ function matchesReviewArtifact(comment, artifactId, artifactType) {
   }
   return comment.state === "COMMENTED" && !comment.path;
 }
+var INFRA_FAIL_CIRCUIT_BREAKER_THRESHOLD = 2;
 function createWorkFinishTool(ctx) {
   return (toolCtx) => ({
     name: "work_finish",
@@ -120882,7 +120945,7 @@ function createWorkFinishTool(ctx) {
       properties: {
         channelId: { type: "string", description: "YOUR chat/group ID \u2014 the numeric ID of the chat you are in right now (e.g. '-1003844794417'). Do NOT guess; use the ID of the conversation this message came from." },
         role: { type: "string", enum: getAllRoleIds(), description: "Worker role" },
-        result: { type: "string", enum: ["done", "pass", "fail", "refine", "blocked", "approve", "reject"], description: "Completion result" },
+        result: { type: "string", enum: ["done", "pass", "fail", "fail_infra", "refine", "blocked", "approve", "reject"], description: "Completion result. Use fail_infra (tester only) when the test toolchain is missing or broken \u2014 this keeps the issue in the test queue instead of routing it to the developer." },
         summary: { type: "string", description: "Brief summary" },
         prUrl: { type: "string", description: "PR/MR URL (auto-detected if omitted)" },
         createdTasks: {
@@ -120964,6 +121027,79 @@ function createWorkFinishTool(ctx) {
         })),
         keyTransitions: resolvedConfig.workflowMeta.keyTransitions
       });
+      if (role === "tester" && result === "fail_infra") {
+        const currentInfraFails = (issueRuntime?.infraFailCount ?? 0) + 1;
+        await updateIssueRuntime(workspaceDir, project.slug, issueId, {
+          infraFailCount: currentInfraFails
+        });
+        await log(workspaceDir, "infra_failure", {
+          project: project.name,
+          issue: issueId,
+          role,
+          result,
+          summary: summary ?? null,
+          infraFailCount: currentInfraFails
+        });
+        const notifyConfig = getNotificationConfig(ctx.pluginConfig);
+        const target = resolveNotifyChannel([], project.channels);
+        const issueUrl = `https://github.com/${project.repo}/issues/${issueId}`;
+        await notify(
+          {
+            type: "infraFailure",
+            project: project.name,
+            issueId,
+            issueUrl,
+            summary: summary ?? "Infrastructure failure during testing",
+            infraFailCount: currentInfraFails
+          },
+          {
+            workspaceDir,
+            config: notifyConfig,
+            channelId: target?.channelId,
+            channel: target?.channel ?? "telegram",
+            runtime: ctx.runtime,
+            accountId: target?.accountId,
+            messageThreadId: target?.messageThreadId,
+            runCommand: ctx.runCommand
+          }
+        ).catch((err) => {
+          getRootLogger().warn(`infra_failure notification failed: ${err}`);
+        });
+        if (currentInfraFails >= INFRA_FAIL_CIRCUIT_BREAKER_THRESHOLD) {
+          await log(workspaceDir, "infra_failure_circuit_breaker", {
+            project: project.name,
+            issue: issueId,
+            infraFailCount: currentInfraFails
+          });
+          await resilientLabelTransition(provider, issueId, "Testing", "Refining");
+        } else {
+          await resilientLabelTransition(provider, issueId, "Testing", "To Test");
+        }
+        await deactivateWorker(workspaceDir, project.slug, "tester", {
+          level: slotLevel,
+          slotIndex,
+          issueId: String(issueId)
+        });
+        await recordIssueLifecycle({
+          workspaceDir,
+          slug: project.slug,
+          issueId,
+          stage: "session_completed",
+          sessionKey: toolCtx.sessionKey ?? null,
+          details: { role, result, infraFailCount: currentInfraFails }
+        }).catch(() => {
+        });
+        return jsonResult2({
+          success: true,
+          project: project.name,
+          projectSlug: project.slug,
+          issueId,
+          role,
+          result,
+          infraFailCount: currentInfraFails,
+          circuitBroken: currentInfraFails >= INFRA_FAIL_CIRCUIT_BREAKER_THRESHOLD
+        });
+      }
       if (!getRule(role, result, workflow))
         throw new Error(`Invalid completion: ${role}:${result}`);
       const repoPath = resolveRepoPath(project.repo);
@@ -121082,6 +121218,9 @@ function createWorkFinishTool(ctx) {
         details: { role, result }
       }).catch(() => {
       });
+      if (role === "tester" && issueRuntime?.infraFailCount) {
+        await updateIssueRuntime(workspaceDir, project.slug, issueId, { infraFailCount: 0 });
+      }
       return jsonResult2({
         success: true,
         project: project.name,
@@ -124469,6 +124608,7 @@ init_audit();
 init_audit();
 init_workflow();
 init_context3();
+init_labels();
 var GRACE_PERIOD_MS = 5 * 60 * 1e3;
 var DISPATCH_CONFIRMATION_TIMEOUT_MS = 2 * 60 * 1e3;
 var NUDGE_MESSAGE = `You appear to have stalled. Continue working on your current task. If you are blocked or unable to proceed, call work_finish with result "blocked".`;
@@ -124578,7 +124718,7 @@ async function checkWorkerHealth(opts) {
       async function revertLabel(fix, from, to) {
         if (!issueIdNum) return;
         try {
-          await provider.transitionLabel(issueIdNum, from, to);
+          await resilientLabelTransition(provider, issueIdNum, from, to);
           fix.labelReverted = `${from} \u2192 ${to}`;
         } catch {
           fix.labelRevertFailed = true;
@@ -125131,7 +125271,7 @@ async function scanOrphanedLabels(opts) {
             queueLabel,
             workflow
           );
-          await provider.transitionLabel(issue2.iid, activeLabel, revertTarget);
+          await resilientLabelTransition(provider, issue2.iid, activeLabel, revertTarget);
           fix.fixed = true;
           fix.labelReverted = `${activeLabel} \u2192 ${revertTarget}`;
           fix.issue.expectedLabel = revertTarget;
@@ -134220,6 +134360,23 @@ async function getLifecycleService(workspaceDir, logger6) {
   return created;
 }
 
+// lib/utils/async.ts
+async function raceWithTimeout(fn, timeoutMs, onTimeout) {
+  let timer;
+  const timeoutPromise = new Promise((resolve3) => {
+    timer = setTimeout(() => {
+      onTimeout();
+      resolve3("timeout");
+    }, timeoutMs);
+  });
+  try {
+    const result = await Promise.race([fn(), timeoutPromise]);
+    return result;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 // lib/services/heartbeat/tick-runner.ts
 init_audit();
 
@@ -134509,6 +134666,7 @@ init_workflow();
 // lib/services/heartbeat/review.ts
 init_workflow();
 init_audit();
+init_labels();
 async function reviewPass(opts) {
   const rc = opts.runCommand;
   const { workspaceDir, projectName, workflow, provider, repoPath, gitPullTimeoutMs = 3e4, baseBranch, onMerge, onFeedback, onPrClosed } = opts;
@@ -134546,7 +134704,7 @@ async function reviewPass(opts) {
           const targetKey2 = typeof changesTransition === "string" ? changesTransition : changesTransition.target;
           const targetState2 = workflow.states[targetKey2];
           if (targetState2) {
-            await provider.transitionLabel(issue2.iid, state.label, targetState2.label);
+            await resilientLabelTransition(provider, issue2.iid, state.label, targetState2.label);
             await log(workspaceDir, "review_transition", {
               project: projectName,
               issueId: issue2.iid,
@@ -134569,7 +134727,7 @@ async function reviewPass(opts) {
           const targetKey2 = typeof conflictTransition === "string" ? conflictTransition : conflictTransition.target;
           const targetState2 = workflow.states[targetKey2];
           if (targetState2) {
-            await provider.transitionLabel(issue2.iid, state.label, targetState2.label);
+            await resilientLabelTransition(provider, issue2.iid, state.label, targetState2.label);
             await log(workspaceDir, "review_transition", {
               project: projectName,
               issueId: issue2.iid,
@@ -134601,7 +134759,7 @@ async function reviewPass(opts) {
           const closedActions = typeof closedTransition === "object" ? closedTransition.actions : void 0;
           const targetState2 = workflow.states[targetKey2];
           if (targetState2) {
-            await provider.transitionLabel(issue2.iid, state.label, targetState2.label);
+            await resilientLabelTransition(provider, issue2.iid, state.label, targetState2.label);
             if (closedActions) {
               for (const action of closedActions) {
                 switch (action) {
@@ -134716,7 +134874,7 @@ async function reviewPass(opts) {
                   const failedKey = typeof failedTransition === "string" ? failedTransition : failedTransition.target;
                   const failedState = workflow.states[failedKey];
                   if (failedState) {
-                    await provider.transitionLabel(issue2.iid, state.label, failedState.label);
+                    await resilientLabelTransition(provider, issue2.iid, state.label, failedState.label);
                     await log(workspaceDir, "review_transition", {
                       project: projectName,
                       issueId: issue2.iid,
@@ -134761,7 +134919,7 @@ async function reviewPass(opts) {
         }
       }
       if (aborted2) continue;
-      await provider.transitionLabel(issue2.iid, state.label, targetState.label);
+      await resilientLabelTransition(provider, issue2.iid, state.label, targetState.label);
       await log(workspaceDir, "review_transition", {
         project: projectName,
         issueId: issue2.iid,
@@ -134791,6 +134949,7 @@ async function reactToFeedbackComments(provider, issueId) {
 // lib/services/heartbeat/review-skip.ts
 init_workflow();
 init_audit();
+init_labels();
 async function reviewSkipPass(opts) {
   const rc = opts.runCommand;
   const { workspaceDir, projectName, workflow, provider, repoPath, gitPullTimeoutMs = 3e4, onMerge } = opts;
@@ -134874,7 +135033,7 @@ async function reviewSkipPass(opts) {
                   const failedKey = typeof failedTransition === "string" ? failedTransition : failedTransition.target;
                   const failedState = workflow.states[failedKey];
                   if (failedState) {
-                    await provider.transitionLabel(issue2.iid, state.label, failedState.label);
+                    await resilientLabelTransition(provider, issue2.iid, state.label, failedState.label);
                     transitions++;
                   }
                 }
@@ -134917,7 +135076,7 @@ async function reviewSkipPass(opts) {
         }
       }
       if (aborted2) continue;
-      await provider.transitionLabel(issue2.iid, state.label, targetState.label);
+      await resilientLabelTransition(provider, issue2.iid, state.label, targetState.label);
       await log(workspaceDir, "review_skip_transition", {
         project: projectName,
         issueId: issue2.iid,
@@ -134934,6 +135093,7 @@ async function reviewSkipPass(opts) {
 // lib/services/heartbeat/test-skip.ts
 init_workflow();
 init_audit();
+init_labels();
 async function testSkipPass(opts) {
   const { workspaceDir, projectName, workflow, provider, repoPath, gitPullTimeoutMs = 3e4, runCommand } = opts;
   let transitions = 0;
@@ -134999,7 +135159,7 @@ async function testSkipPass(opts) {
                   const failedKey = typeof failedTransition === "string" ? failedTransition : failedTransition.target;
                   const failedState = workflow.states[failedKey];
                   if (failedState) {
-                    await provider.transitionLabel(issue2.iid, state.label, failedState.label);
+                    await resilientLabelTransition(provider, issue2.iid, state.label, failedState.label);
                     transitions++;
                   }
                 }
@@ -135044,7 +135204,7 @@ async function testSkipPass(opts) {
         }
       }
       if (aborted2) continue;
-      await provider.transitionLabel(issue2.iid, state.label, targetState.label);
+      await resilientLabelTransition(provider, issue2.iid, state.label, targetState.label);
       await log(workspaceDir, "test_skip_transition", {
         project: projectName,
         issueId: issue2.iid,
@@ -135061,6 +135221,7 @@ async function testSkipPass(opts) {
 // lib/services/heartbeat/hold-escape.ts
 init_workflow();
 init_audit();
+init_labels();
 async function holdEscapePass(opts) {
   const { workspaceDir, projectName, workflow, provider } = opts;
   let transitions = 0;
@@ -135094,7 +135255,7 @@ async function holdEscapePass(opts) {
         }
         await provider.closeIssue(issue2.iid);
         await clearIssueRuntime(workspaceDir, project.slug, issue2.iid);
-        await provider.transitionLabel(issue2.iid, state.label, terminalState.label);
+        await resilientLabelTransition(provider, issue2.iid, state.label, terminalState.label);
         await log(workspaceDir, "hold_escape_transition", {
           project: projectName,
           issueId: issue2.iid,
@@ -135958,21 +136119,6 @@ function registerHeartbeatService(api, pluginCtx) {
     }
   });
 }
-async function raceWithTimeout(fn, timeoutMs, onTimeout) {
-  let timer;
-  const timeoutPromise = new Promise((resolve3) => {
-    timer = setTimeout(() => {
-      onTimeout();
-      resolve3("timeout");
-    }, timeoutMs);
-  });
-  try {
-    const result = await Promise.race([fn(), timeoutPromise]);
-    return result;
-  } finally {
-    clearTimeout(timer);
-  }
-}
 var DEFAULT_TICK_TIMEOUT_MS = 5e4;
 var _ticksTimedOut = 0;
 async function withTickMutex(fn) {
@@ -136010,23 +136156,39 @@ async function runHeartbeatTick(ctx, logger6, mode) {
       })
     );
     const tickFn = lifecycle ? () => lifecycle.track(mode === "repair" ? "recovery" : "heartbeat", {}, run) : run;
-    let tickPromise;
-    const wrappedTickFn = () => {
-      tickPromise = tickFn();
-      return tickPromise;
+    let resolveTick;
+    let rejectTick;
+    const tickPromise = new Promise((res, rej) => {
+      resolveTick = res;
+      rejectTick = rej;
+    });
+    tickPromise.catch(() => {
+    });
+    const wrappedTickFn = async () => {
+      try {
+        const result = await tickFn();
+        resolveTick(result);
+        return result;
+      } catch (err) {
+        rejectTick(err);
+        throw err;
+      }
     };
+    const HARD_TICK_TIMEOUT_MS = 5 * 6e4;
     const raceResult = await raceWithTimeout(wrappedTickFn, DEFAULT_TICK_TIMEOUT_MS, () => {
       _ticksTimedOut++;
       timedOut = true;
       logger6.warn(`work_heartbeat ${mode} tick timed out after ${DEFAULT_TICK_TIMEOUT_MS}ms (total timeouts: ${_ticksTimedOut})`);
-      if (tickPromise) {
-        tickPromise.finally(() => {
-          _tickRunning[mode] = false;
-          _anyTickRunning = false;
-        });
-      } else {
-        logger6.error("tick_mutex: tickPromise undefined in timeout handler \u2014 this is a bug");
-      }
+      const hardTimeout = setTimeout(() => {
+        logger6.error("tick_mutex: hard timeout \u2014 forcing mutex release");
+        _tickRunning[mode] = false;
+        _anyTickRunning = false;
+      }, HARD_TICK_TIMEOUT_MS);
+      tickPromise.finally(() => {
+        clearTimeout(hardTimeout);
+        _tickRunning[mode] = false;
+        _anyTickRunning = false;
+      });
     });
     void raceResult;
   } catch (err) {
@@ -138256,6 +138418,14 @@ async function pathExists(candidate) {
     return false;
   }
 }
+async function isValidBinary(filePath) {
+  try {
+    const stat2 = await fs34.stat(filePath);
+    return stat2.size > 0;
+  } catch {
+    return false;
+  }
+}
 function familyForStack(stack) {
   if (NODE_STACKS.has(stack)) return "node";
   if (PYTHON_STACKS.has(stack)) return "python";
@@ -138368,7 +138538,7 @@ function buildPythonBootstrapPrelude() {
 
 # --- Shared toolchain (ruff, mypy, pip-audit) ---
 TOOLCHAIN="$HOME/.openclaw/toolchains/python"
-if [ ! -x "$TOOLCHAIN/bin/ruff" ]; then
+if [ ! -x "$TOOLCHAIN/bin/ruff" ] || [ ! -s "$TOOLCHAIN/bin/ruff" ]; then
   echo "[qa] Toolchain not found \u2014 provisioning..."
   command -v uv >/dev/null 2>&1 || {
     curl -LsSf https://astral.sh/uv/install.sh | sh
@@ -138506,16 +138676,22 @@ Install manually: curl -LsSf ${UV_INSTALL_URL} | sh`
 var PYTHON_TOOLCHAIN_PACKAGES = ["ruff", "mypy", "pip-audit"];
 var TOOLCHAIN_DIR = ".openclaw/toolchains/python";
 var TOOLCHAIN_FINGERPRINT_FILE = "toolchain.sha256";
-function toolchainFingerprint() {
-  return createHash4("sha256").update(PYTHON_TOOLCHAIN_PACKAGES.join(",")).digest("hex");
+async function toolchainFingerprint(runCommand) {
+  let pythonVersion = "unknown";
+  try {
+    const result = await runCommand("python3", ["--version"], { timeout: 5e3 });
+    if (result.exitCode === 0) pythonVersion = result.stdout.trim();
+  } catch {
+  }
+  return createHash4("sha256").update(PYTHON_TOOLCHAIN_PACKAGES.join(",") + ":" + pythonVersion).digest("hex");
 }
 async function ensurePythonToolchain(runCommand, homeDir) {
   const home = homeDir ?? process.env.HOME ?? "/tmp";
   const toolchainPath = path34.join(home, TOOLCHAIN_DIR);
   const ruffPath = path34.join(toolchainPath, "bin", "ruff");
   const fingerprintPath = path34.join(toolchainPath, TOOLCHAIN_FINGERPRINT_FILE);
-  const expectedFp = toolchainFingerprint();
-  if (await pathExists(ruffPath)) {
+  const expectedFp = await toolchainFingerprint(runCommand);
+  if (await isValidBinary(ruffPath)) {
     try {
       const currentFp = (await fs34.readFile(fingerprintPath, "utf-8")).trim();
       if (currentFp === expectedFp) {
@@ -139112,17 +139288,6 @@ var scaffoldStep = {
           mode: "scaffold",
           runCommand: ctx.runCommand
         });
-        if (!bootstrap.ready) {
-          ctx.log(`Scaffold bootstrap failed: ${bootstrap.reason ?? "unknown reason"}`);
-          return {
-            ...result.plannedPayload,
-            step: "scaffold",
-            scaffold: { created: false, reason: bootstrap.reason ?? "bootstrap_failed" }
-          };
-        }
-        ctx.log(
-          bootstrap.skipped ? `Scaffold bootstrap already current (${bootstrap.packageManager})` : `Scaffold bootstrap completed (${bootstrap.packageManager})`
-        );
         if (scaffold.stack && PYTHON_STACKS2.has(scaffold.stack) && payload.spec) {
           try {
             const contract = generateQaContract({
@@ -139137,6 +139302,17 @@ var scaffoldStep = {
             ctx.log(`Warning: could not write qa.sh: ${err instanceof Error ? err.message : String(err)}`);
           }
         }
+        if (!bootstrap.ready) {
+          ctx.log(`Scaffold bootstrap failed: ${bootstrap.reason ?? "unknown reason"}`);
+          return {
+            ...result.plannedPayload,
+            step: "scaffold",
+            scaffold: { created: false, reason: bootstrap.reason ?? "bootstrap_failed" }
+          };
+        }
+        ctx.log(
+          bootstrap.skipped ? `Scaffold bootstrap already current (${bootstrap.packageManager})` : `Scaffold bootstrap completed (${bootstrap.packageManager})`
+        );
       }
       return {
         ...result.plannedPayload,
@@ -142147,6 +142323,7 @@ function shouldSuppressTelegramBootstrapReply(session, request2) {
 }
 
 // lib/dispatch/telegram-bootstrap-hook.ts
+var BOOTSTRAP_TIMEOUT_MS = 5 * 6e4;
 var BOOTSTRAP_MESSAGES = {
   ack: {
     pt: "Recebi! Vou analisar e come\xE7ar a montar o projeto...",
@@ -142416,8 +142593,24 @@ async function classifyAndBootstrap(ctx, workspaceDir, conversationId, content)
     await sendTelegramText(ctx, conversationId, buildClarificationMessage(parsed, pendingClarification, language));
     return;
   }
-  continueBootstrap(ctx, conversationId, workspaceDir, incomingRequest, sourceRoute).catch((err) => {
-    logBootstrapWarning(ctx, `[telegram-bootstrap] unhandled pipeline error (LLM path): ${err instanceof Error ? err.message : String(err)}`);
+  bootstrapWithTimeout(ctx, conversationId, workspaceDir, incomingRequest, sourceRoute);
+}
+function bootstrapWithTimeout(ctx, conversationId, workspaceDir, request2, sourceRoute) {
+  raceWithTimeout(
+    () => continueBootstrap(ctx, conversationId, workspaceDir, request2, sourceRoute),
+    BOOTSTRAP_TIMEOUT_MS,
+    () => {
+      ctx.logger.warn({ conversationId }, "Bootstrap pipeline timed out after 5 minutes");
+      upsertTelegramBootstrapSession(workspaceDir, {
+        conversationId,
+        rawIdea: request2.rawIdea,
+        status: "failed",
+        error: "Pipeline timeout (5min)"
+      }).catch(() => {
+      });
+    }
+  ).catch((err) => {
+    logBootstrapWarning(ctx, `[telegram-bootstrap] pipeline error: ${err instanceof Error ? err.message : String(err)}`);
   });
 }
 async function continueBootstrap(ctx, conversationId, workspaceDir, request2, sourceRoute) {
@@ -142432,6 +142625,24 @@ async function continueBootstrap(ctx, conversationId, workspaceDir, request2, so
   }
   const projectName = request2.projectName ?? void 0;
   const stackHint = request2.stackHint;
+  if (!stackHint) {
+    const existingSession = await readTelegramBootstrapSession(workspaceDir, conversationId);
+    const lang = existingSession?.language ?? "pt";
+    await upsertTelegramBootstrapSession(workspaceDir, {
+      conversationId,
+      rawIdea: request2.rawIdea,
+      projectName: request2.projectName ?? void 0,
+      status: "clarifying",
+      pendingClarification: "stack",
+      language: lang
+    });
+    await sendTelegramText(ctx, conversationId, buildClarificationMessage(
+      { rawIdea: request2.rawIdea, projectName: request2.projectName ?? void 0, stackHint: request2.stackHint ?? void 0 },
+      "stack",
+      lang
+    ));
+    return;
+  }
   const candidateSlug = inferProjectSlug(projectName ?? request2.rawIdea);
   if (candidateSlug) {
     const projects = await readProjects(workspaceDir).catch(() => null);
@@ -142680,11 +142891,9 @@ function registerTelegramBootstrapHook(api, ctx) {
         repoPath: existingSession.repoPath ?? null
       };
       ctx.logger.info(`[telegram-bootstrap] clarification resolved: stack=${mergedRequest.stackHint}, idea="${mergedRequest.rawIdea}" (conversation: ${conversationId})`);
-      continueBootstrap(ctx, conversationId, workspaceDir, mergedRequest, existingSession.sourceRoute ?? {
+      bootstrapWithTimeout(ctx, conversationId, workspaceDir, mergedRequest, existingSession.sourceRoute ?? {
         channel: "telegram",
         channelId: conversationId
-      }).catch((err) => {
-        logBootstrapWarning(ctx, `[telegram-bootstrap] unhandled pipeline error: ${err instanceof Error ? err.message : String(err)}`);
       });
       return;
     }
@@ -142752,11 +142961,9 @@ function registerTelegramBootstrapHook(api, ctx) {
       await sendTelegramText(ctx, conversationId, buildClarificationMessage(parsed, pendingClarification, language));
       return;
     }
-    continueBootstrap(ctx, conversationId, workspaceDir, incomingRequest, {
+    bootstrapWithTimeout(ctx, conversationId, workspaceDir, incomingRequest, {
       channel: "telegram",
       channelId: conversationId
-    }).catch((err) => {
-      logBootstrapWarning(ctx, `[telegram-bootstrap] unhandled pipeline error: ${err instanceof Error ? err.message : String(err)}`);
     });
   });
 }